Bomb threatmanagement

E&S Technical Information

COPYRIGHT © 2000, Insurance Services Office, Inc.; [email protected]

1

Crime Prevention

Bomb Threat Management

Report Number: CP-95-10Release Date: December 18, 1996Section Title: Security Management

AbstractBombs and the threat of their use have become the primary weapons of the terrorist. They are also used as ameans of retaliation by employees with real or fancied grievances, as well as by criminal extortionists. Thisreport provides information on the general guidelines that can be used in developing a plan to reduce the risk ofbombing incidents. Information on handling bomb threats and procedures for evacuating a facility andconducting bomb searches are also included.

IntroductionA bomb threat is an effective means of disrupting business. The problems are intensified when the incidentinvolves an actual explosive or incendiary device. Although there is no foolproof means of securing a premisesagainst a bomb threat (or bomb attack), a good security plan, correctly executed, will enable a business to dealwith an incident properly.

Bombs and the threat of their use have become the primary weapon of the terrorist. They are also used as ameans of retaliation by employees with real or fancied grievances, as well as by criminal extortionists.

This report provides information on the general guidelines that can be used in developing a plan to reduce therisk of bombing incidents. Information on handling bomb threats and procedures for evacuating a facility andconducting bomb searches are also included.

Bombing IncidentsThe Federal Bureau of Investigation (FBI), in its 1994 Bombing Incidents, reported that there were 3,163 actualand attempted bombing incidents reported to the FBI's Explosives Unit-Bomb Data Center in 1994, the latestyear for which data is available. This was a 6 percent increase over 1993 bombings (2,980).

The 1994 bombings injured 308 and killed 31 individuals. Damage to properties was estimated at $7.5 million.The top five bombing targets were residential properties at 52 percent, commercial properties and vehicles bothat 11 percent, open areas at 7 percent, and academic facilities at 4 percent.

The use of explosives in bombings accounted for 77 percent of the incidents. The remaining 23 percent wereincendiary incidents. In 78 percent of the bombing incidents, the devices successfully detonated or ignited; 22percent were unsuccessful. Explosive devices detonated as planned 79 percent of the time, and incendiarydevices detonated 75 percent of the time.

Four percent of actual or attempted bombings were preceded by a warning or a threat. Eighty-six percent of thethreats were verbal, and 14 percent were written.

Table 1 summarizes bombing incidents for the period 1984 through 1994.

Table 1. Bombing Incidents: 1984-1994

Statistic 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994




2

Total 803 847 858 848 977 1208 1582 2499 2989 2980 3163ActualExplosive

518 575 580 600 593 641 931 1551 1911 1880 1916

Incendiary

127 102 129 104 156 203 267 423 582 538 545

AttemptsExplosive

118 113 101 102 161 243 254 395 348 375 522

Incendiary

40 57 48 42 40 91 130 130 112 187 180

PropertyDamage($M)

5.61 6.35 3.40 4.20 2.26 5.00 9.60 6.44 12.5 518* 7.5

PersonsInujured

112 144 185 107 145 202 222 230 349 1323* 308

Deaths[Footnote1]

6 28 14 21 20 11 27 29 26 49 31

There were 474 incidents involving the placement of hoax devices. Thirty-seven percent were preceded by athreatening note, letter, or telephone call to the establishment or individual target. Financial institutions receivedsome type of threat before the incident 72 percent of the time and commercial/retail establishments 58 percentof the time. Offices were warned 29 percent of the time, academic facilities 30 percent, and residential propertyowners were warned 18 percent of the time.

Trends in bombing incidents can usually be linked to political and/or social unrest. For example, in the 30-month period between May 1976 and December 1978, the Red Brigade, an Italian terrorist organization,carried out bombing attacks against 10 computer centers because of their belief that "computers representinstruments of the capitalist system." Recently, as a result of political unrest in the Middle East, terrorists havethreatened to bomb U.S. targets throughout the world.

Labor unrest is another example. A labor strike in Virginia in 1989 was the apparent reason for most of thebombing incidents in that state. The FBI report notes that in fully one-half of all reported incidents in 1989,strike-related matters were reported as probable motives. Also, when companies and organizations are forcedto reduce their manning levels as a means of cutting costs, some victims of these layoffs feel a sense ofbitterness and frustration against the organization that has "rejected" them. Often they resort to bomb threatsas a means of "revenge."

Narcotics have historically been linked to bombing incidents. In Kentucky, there were several cases in 1989 ofbooby-trapped marijuana fields.

Car bombs, such as the ones that destroyed the federal building in Oklahoma City in April 1995 and damagedNew York City's World Trade Center building in February 1993, added a new dimension to terrorism in the U.S.In response, the U.S. Department of Justice developed and published the Vulnerability Assessment of FederalFacilities. This publication contains a set of 52 minimum security standards and recommendations for applyingthe standards to federal buildings.

Purpose of a Bomb ThreatThe only reasonable explanations for a call reporting that a bomb is to go off at a particular location are:

• The caller has definite knowledge or believes that an explosive or incendiary device has been or willbe placed and may want to minimize personal injury or property damage. The caller may be either theperson who placed the device or someone else who has become aware of such information.




3

• The caller wants to create an atmosphere of anxiety and panic which will, in turn, possibly result in adisruption of the normal activities at the facility where the device is purportedly located.

When a bomb threat call has been received, there will be a reaction to it. If the call is directed at a businesswhere there has been no organized, advance planning to handle such a threat, the call may result in panic.

Panic is defined as a "sudden, excessive, unreasoning, infectious terror." Panic is caused by fear - fear of theknown or the unknown. It is one of the most contagious of all human emotions. Panic can also be defined, inthe context of a bomb threat call, as the ultimate achievement of the caller.

Once a state of panic has been reached, the potential for personal injury and property damage is dramaticallyincreased. Emergency and essential facilities may be shut down or abandoned and the community denied theiruse at a critical time.

Leaving facilities unattended can lead to destruction of the facility and the surrounding area. Large chemicalmanufacturing plants, power plants, unattended boilers, and other such facilities often require the constantattention of operating personnel.

Other effects of not being prepared, or not having an organized plan to handle bomb threat calls, can result in alack of confidence in the leadership. This will be reflected in lower morale and productivity, or reluctance on thepart of employees to continue employment at a location that is being subjected to bomb threat calls.

PreparationLines of organization and plans must be made in advance to handle bomb threats. Clear-cut levels of authoritymust be established. By having established procedures, a bomb threat can be handled with the least risk,instilling confidence in employees and eliminating panic.

In planning, a control center or command post should be designated. This control center should be located inthe switchboard room or other focal point of telephone or radio communications. The management personnelassigned to operate the control center should have decision-making authority on the action to be taken duringthe threat. Only those with assigned duties should be permitted in the control center. Provision should be madefor substitutes in the event someone is absent when the threat is received.

A vulnerability assessment of the facility or building and an estimate of the risk of attack must be made. Thepurpose of this evaluation is to assure that security plans are appropriate to the area being protected, to serveas a basis on which to formulate a security plan that is proportional to the existing or potential risk, and toprovide for updating or revising plans to include appropriate countermeasures for new hazards.

An examination of the physical security of the facility should be made to determine how vulnerable it is to abombing attack. Some facilities, due to their physical layout, are inherently more vulnerable. A potential bombermust, in most cases, situate the explosive device on the premises. Therefore, control of access to the premisesis the cornerstone of a security plan.

The following recommendations are intended as guidelines in developing a plan to handle bomb threats andincidents:

• Contact the police, fire department, or other local governmental agencies to determine whether anyhas a bomb disposal unit. Under what conditions is the bomb disposal unit available? What is thetelephone number? How can the services of the bomb disposal unit be obtained in the event of abomb threat? Will the bomb disposal unit assist in the physical search of the building, or will they onlydisarm or remove explosives?

• Develop a positive means of identifying personnel and controlling access to the facility.

• Establish strict procedures for control and inspection of packages and material entering critical areas.




4

• Inspect the building to determine which areas explosives are likely to be concealed. Locations to beconsidered include: elevator shafts; ceiling areas; rest rooms; crawl spaces in rest rooms; utilityclosets for plumbing, electrical and other services; closet areas; spaces under stairwells; boiler(furnace) rooms; storage areas; utility areas for main switches and valves for electricity, gas, and fuel;indoor trash receptacles; record storage areas; mail rooms; ceiling lights with easily removablepanels; and fire hose racks. While this list is not complete, it provides suggestions of where a time-delayed explosive or an incendiary device may be concealed.

• Instruct security and maintenance personnel to make periodic checks of all rest rooms, stairwells,under stairwells, and other key areas of the building to assure that unauthorized personnel are nothiding in the building.

• Provide adequate protection for classified documents, proprietary information, and other recordsessential to the operation of the business. A well-planted, properly charged device could, upondetonation, destroy those records needed in day-to-day operations.

• Instruct all personnel in the procedures to be followed in the event a bomb threat is received. As aminimum, every telephone operator or receptionist should be trained to respond calmly to a bombthreat call.

• In addition, it is always desirable that more than one person listen in on the call. To do this, have acovert signaling system, perhaps a coded buzzer signal, to a second reception point. A calmresponse to the bomb threat could result in getting additional information. This is especially true if thecaller wishes to avoid injuries or deaths. If told that the building is occupied or cannot be evacuated intime, the bomber may be willing to give more specific information on the bomb's location.

• Organize and train an evacuation unit. The organization and training of this unit should becoordinated with other tenants of the building.

The evacuation unit should be trained on how to evacuate the building during a bomb threat.Evacuation training is usually available from police, fire, or other units within the community.

If the facility is in a multi-tenant building, obligations to other tenants in the building must beconsidered. Legal, moral, and ethical considerations will have an impact on what is communicated toneighbors.

• Develop a plan for conducting a bomb search. Consult with the police, fire department, or other localauthority to determine who will conduct the search. In most cases, because of their familiarity with thefacility, the search is best conducted by company/building personnel; this requires that they be trainedproperly in search techniques. The police or fire department may be available to assist in the trainingor be able to advise as to who can provide the training.

• Consider arranging for temporary relocation of facilities in the event of an explosion and the buildingbeing determined to be unsafe.

Handling a Bomb ThreatIn April 1996, Texas City, Texas, was virtually shut down from a bomb scare. A caller to 911 said that sevenbombs had been planted at area chemical plants, that three were dummies, and that four would explode at 6p.m. on the following day, which was the first anniversary of the Oklahoma City bombing. The harbor wascleared (seven ships and 21 barges were sent out of the port) and a search of the area's chemical plantsconducted. Some residents fled the city before the caller's deadline. Three dummy bombs, but no real bombs,were later found.




5

Under most circumstances, because of the difficulty in discriminating in advance between a threat which iscredible and one which is not, the response is the same - all threats must be taken seriously and properlyaddressed. On the other hand, a business must decide if it is feasible to evacuate a building every time a threatis received.

Telephone ThreatsWhen a bomb threat is called in, the procedures listed hereafter should be followed:

• Keep the caller on the line and attempt to get as much information as possible. Ask for the messageto be repeated to confirm it. If possible, record the message.

• If the caller does not indicate the location of the bomb or the time of possible detonation, ask for thisinformation.

• Inform the caller that the building is occupied and the detonation of a bomb could result in death orserious injury to many innocent people.

• Pay particular attention to background noises which may give a clue as to the location of the caller.

• Listen closely to the voice (male or female), voice quality (calm or excited), accents, and speechimpediments. Immediately after the caller hangs up, report the call to the person designated bymanagement to receive such information. Law enforcement personnel will want to talk first-hand withthe person who received the call.

• Report the threat immediately to the appropriate agencies, such as the police or fire department orFBI.

To assist the individual receiving the call, a bomb threat call checklist of the type illustrated in Appendix A,which was prepared by the FBI Bomb Data Center, should be kept nearby.

Written ThreatsWhile written messages are usually associated with generalized threats and extortion attempts, a writtenwarning of a specific device may occasionally be received. It should never be ignored. When a written threat isreceived, the procedures listed below should be followed:

• Save all materials, including any envelope or container. Once the message is recognized as a bombthreat, further unnecessary handling should be avoided.

• Every possible effort must be made to retain evidence, such as fingerprints, handwriting ortypewriting, paper, and postal marks, which are essential to tracing the threat and identifying thewriter.

Mail and Package BombsIn 1989, a series of letter bombings, believed to be racially motivated, resulted in several casualties, includingfatalities. On December 16, 1989, a U.S. Court of Appeals Judge in Alabama was killed instantly and his wifeinjured when a package exploded when it was opened in their residence.

Two days later, a Georgia attorney was killed in a similar incident. On the same day, in related attacks, a U.S.courthouse in Atlanta and the headquarters of the National Association for the Advancement of Colored People(NAACP) in Jacksonville, Florida, were the targets of attempted bombings.

These attacks spawned copycat bombings, as well as renewed interest in letter and package bombs. Inresponse to these attacks, the FBI Bomb Data Center developed the following letter and package bombindicators and recognition points:




6

• Excessive postage

• Incorrect titles

• Titles but no names

• Misspellings of common words

• Oily stains or discoloration

• No return address

• Excessive weight

• A rigid envelope

• Lopsided or an uneven envelope

• A strange odor

• Protruding wires or tinfoil

• Visual distractions

• Foreign mail, air mail, and special delivery

• Restrictive markings, such as confidential and personal

• Hand written or poorly typed messages

• Excessive securing material, such as masking tape and string

In the Atlanta courthouse incident, routine X-ray screening of incoming mail revealed that the packagecontained a pipe bomb. A bomb disposal unit was called and the bomb was removed without incident. Bomband metal detection equipment available today employ various technologies to find dangerous objects, and aninvestment in such equipment is a function of an assessment of the seriousness of the threat posed to thebusiness.

The Decision to EvacuateThe most serious of all decisions to be made by management in the event of a bomb threat is evacuation ornon-evacuation of the building. If bomb threats are occurring frequently, management cannot be expected toevacuate the facility after every threat. All bomb threats present an element of risk, and as such, decisionsmust be made during the planning phase as to when an evacuation is ordered.

Management may pronounce a carte blanche policy that, in the event of a bomb threat, evacuation will beaffected immediately. This decision circumvents the calculated risk and gives prime consideration for the safetyof personnel in the building. This can result in production downtime and can be costly if the threat is a hoax.

The alternative is for management to make the decision regarding evacuation when the threat is received. Inthis scenario, time is the critical factor. If the time until detonation is determined to be, for example, less thanhalf an hour, an evacuation should be conducted immediately. If the time until detonation is determined to begreater than half an hour, then a search of the area should be conducted. If the search uncovers a suspiciouspackage, then an evacuation is ordered and the bomb disposal unit contacted; if no package is found,management may decide not to evacuate.




7

If the police, fire department, or other local authority receives the bomb threat and orders an evacuation of thefacility, then an evacuation should be conducted immediately. A 30-minute time period is recommended on theassumption that the size of the area allows for a search to be conducted in such a time period. When properlyplanned and managed, most buildings can be searched in this time. If the area cannot be adequately searchedin 30 minutes, however, then a greater time period should be set.

If the threat is from a prominent subversive group that has been linked to recent bombings, then an evacuationmay be considered regardless of the circumstances.

If the caller provides an indication of the location of the bomb, then those departments or floors affected by thebomb should be evacuated. In high-rise buildings, the two floors below and the two floors above the threatenedfloor should be evacuated. If there is no indication as to the location of the bomb, and the threat is determinedto be legitimate, then the entire building may have to be evacuated.

EvacuationThe people in the building should be evacuated to a safe distance from the building to protect them againstdebris and other flying objects in the event of an explosion. In highly congested areas, it is usuallyrecommended that a mutual assistance agreement be arranged with another company which would allow forevacuation of employees to another building. If the location of the suspected bomb is known, evacuation routeswill have to be determined so as to lead people away from the bomb.

Once the building is evacuated, controls should be established to prevent unauthorized access to the building.If proper coordination has been arranged with the local police or other agencies, this may assist in establishingcontrols to prevent reentry until the danger has passed.

Where possible, all doors and windows should be opened to permit the blast wave to escape in the event of anexplosion. When the building has been evacuated, all gas and fuel lines should be turned off at the main valve.All electrical equipment should be turned off prior to evacuation. The decision to turn off electrical power at themain switch should be made by management with consideration given to lighting requirements of searchteams.

Bomb SearchesAlthough, from a liability standpoint, it may be preferred that bomb searches be conducted by the police or firedepartment, from a practicality standpoint, search teams made up of properly trained company/buildingpersonnel are usually the better choice. This is because the police or fire department will often be unfamiliarwith the facility and may not be trained in bomb search techniques, and the time it would take them to respondto an emergency call could be better spent in conducting a search.

The evacuation unit may be trained in search techniques; however, a separate search unit made up of searchteams for specific areas is preferred. Volunteer personnel should be solicited for this function. To be proficientin searching the building, search personnel must be thoroughly familiar with all hallways, rest rooms, falseceiling areas, and other locations in the building where an explosive or incendiary device may be concealed. Asearch team for an area should consist of people who work in that area, since they are usually more familiarwith the surroundings and know what belongs and does not belong there.

The search unit should be trained only in search techniques and not in the techniques of neutralizing,removing, or otherwise having contact with the device. If a device is located, it should not be disturbed. Thefollowing recommendations apply:

• Do not touch a strange or suspicious object. Its location and description should be reported to theperson designated to receive this information.

• The removal and disarming of a bomb or suspicious object should be left to professionals in explosiveordinance disposal. Who these professionals are and how to contact them for assistance should beincluded in the bomb threat plan.




8

• Once the danger zone is determined, the area should be blocked off or barricaded with a clear zoneof three hundred feet until the object has been removed or disarmed.

• During a search of the building, a rapid two-way communication system is of utmost importance.Such a system can be readily established through existing installed telephones. Caution: The use ofradios or other wireless devices during a search can be dangerous. The radio transmission energycan cause premature detonation of an electric initiator (blasting cap).

• During the search, medical personnel should be alerted to stand by in case of an accident caused bythe explosion of the device.

• Fire brigade personnel should be alerted to stand by.

SummaryPlanning efforts for bomb threats begin with a vulnerability assessment of the facility. An estimate of the risk ofattack is required, based on the type of business, its location, past threats, and current trends.

Management must establish procedures before an incident occurs, so that a bomb threat can be handled withthe least risk of creating panic. Employees must be trained in the proper procedures to follow in handling bombthreats, conducting bomb searches and evacuating a building.

In the past, the majority of bomb threats turned out to be hoaxes. However, today more of the threats arematerializing. Thus, management's first consideration must be for the safety of people. It is practicallyimpossible to determine immediately whether a bomb threat is real or a hoax.

Appendix A - FBI Bomb Threat Call ChecklistBomb Threat Card: Place this card under your telephone.

Questions to Ask• 1. When is bomb going to explode?

• 2. Where is it right now?

• 3. What does it look like?

• 4. What kind of bomb is it?

• 5. What will cause it to explode?

• 6. Did you place the bomb?

• 7. Why?

• 8. What is your address?

• 9. What is your name?

Exact Wording of the Threat• Sex of caller.

• Race of caller




9

• Age of caller.

• Number at which call is received.

• Time of call.

• Date of call.

Caller's Voice• Calm.

• Angry.

• Excited.

• Slow.

• Rapid.

• Soft.

• Loud.

• Laughter.

• Crying.

• Normal.

• Distinct.

• Slurred.

• Nasal.

• Stutter.

• Lisp.

• Raspy.

• Deep.

• Ragged.

• Cleaning throat.

• Deep breathing.

• Cracking voice.

• Disguised.

• Accent.

• Familiar (who did it sound like?)




10

• Whispered.

Background Sounds• Street noises.

• Crockery.

• Voices.

• PA System.

• Music.

• House noises.

• Motor.

• Office machinery.

• Factory machinery.

• Animal noises.

• Clear.

• Static.

• Local.

• Long distance.

• Other.

Threat Language• Well spoken (educated).

• Incoherent.

• Taped (message read by threat maker?)

• Foul.

• Irrational.

RemarksReport call immediately to: [_______]Phone number: [_______]Date: [_______]Name: [_______]Position: [_______]Phone Number: [_______]




11

References• 1. Cornitius, Tim. "Bomb Threats Shake Up South Texas." Chemical Week 1 May 1996.

• 2. Department of Justice. Vulnerability Assessment of Federal Facilities. Washington, DC: UnitedStates Marshals Service, 1995.

• 3. Department of Justice. Federal Bureau of Investigation. 1994 Bombing Incidents. GeneralInformation Bulletin 95-2. Washington, DC: The FBI Explosives Unit-Bomb Data Center, 1995.

• 4. Department of Justice. Federal Bureau of Investigation. Bomb Security Incident Guidelines (2).General Information Bulletin 84-1. Washington, DC: FBI Bomb Data Center, 1984.

• 5. Russo, Robert J. "Planning for Damage Control." Security Management 33.9 (1989): 97-99.

• 6. Slahor, Stephanie, Ph.D. "Bombs and Bomb Threats: Have A Response Plan." Access Control39.10 (1996): 37-38.

Footnotes• Footnote1 The 1993 damage figures include $510 million damage to the World Trade Center building

by a bomb on February 26, 1993. The persons injured figure for 1993 includes the 1,042 persons whowere injured in the same incident.

COPYRIGHT ©2000, Insurance Services Office, Inc.

The information contained in this publication was obtained from sources believed to be reliable. InsuranceServices Office, Inc., its companies and employees make no guarantee of results and assume no liability inconnection with either the information herein contained or the safety suggestions herein made. Moreover, itcannot be assumed that every acceptable safety procedure is contained herein or that abnormal or unusualcircumstances may not warrant or require further or additional procedure.

Bomb threatmanagement

News & Politics

Transcript of Bomb threatmanagement